diff --git a/Cargo.lock b/Cargo.lock
index a5f490c..d768eeb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -700,7 +700,7 @@ dependencies = [
 
 [[package]]
 name = "gree-controller"
-version = "0.13.8"
+version = "0.13.9"
 dependencies = [
  "aes",
  "aes-gcm",
diff --git a/Cargo.toml b/Cargo.toml
index d7302ae..83d4eb2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "gree-controller"
-version = "0.13.8"
+version = "0.13.9"
 edition = "2021"
 authors = ["GREE Controller contributors"]
 description = "Standalone local GREE HVAC controller with Web UI, SQLite and Home Assistant sensor support"
diff --git a/FILE_MANIFEST.sha256 b/FILE_MANIFEST.sha256
index 353bf9a..3a78f22 100644
--- a/FILE_MANIFEST.sha256
+++ b/FILE_MANIFEST.sha256
@@ -1,13 +1,13 @@
 d67af429e4da9ce08e9d2f2a8472849ffbd70d135b1c5da535a076026794d04c  ./.env.example
 a4ec3874a2e3ab1bad28fb40bb620f7b01f64d01ad9b699306bf70ada31227db  ./.gitignore
-ff8ef8ed21e7d3617f9939cd9e809bff06744ffc99202e037b2f31ade4157867  ./Cargo.lock
-fb8bbd5479705582e3aad71568ada6892bc266a56be6ec3d69647a4b8dd30b69  ./Cargo.toml
+36a2cb85329ae82d097a335a6afd81c1ba7bc450eebdac09c600e12befe36ba2  ./Cargo.lock
+5f9afa17638997837880ab244301e3921a6444972154b49797a73bc3103fbcad  ./Cargo.toml
 19b2943504acb8f8de280f873a8dbec4bb6ebbe3870b158f5655d4fb8c298f5f  ./LICENSE
-cd7b1af125c0d65b52042a844bfe9e9575d1c5bde31ebddfc2534231a7599fbb  ./README.md
+a45da91ab1d81a24ddfd561b3ae0c3b0300b57996ddb3df1f0b827ebbd488e87  ./README.md
 bb549919b96b0413152dd905aec8640bb53301f07ec7d0b1be48ccbd37936fef  ./build.rs
-eff2912449a4b78e0b9eb4ff02fa6752e31abcb71fa097a46f1d7596a4500303  ./docs/API.md
+d590a6df7ec31c274a2437075d76305cfafbe56385c800fbf39b18b54875119e  ./docs/API.md
 2e1e18fd8167dabfe2469c26e85cce62486c7cb6a502c63c6f6b0cd74d5885e0  ./docs/FLOW.md
-8f3ca55ab14f855644b3c85074400bf4a4a6b37659f4aa5dd686757a0d2bcd56  ./docs/openapi.json
+3e995a5bb3ec40b26c2676818f90adbd5fa42e760b487d18a16b09a586702484  ./docs/openapi.json
 b11e581dd916676e24402112fe6896bc681abf3c94cafc85c4d3ded3f3a272a3  ./home-assistant/README.md
 f8e8559fe10fe523ac5bc9aac25c6e26e862f679d502e8f3c39f38a0a8e40911  ./home-assistant/custom_components/gree_controller/__init__.py
 3f6ef15ef58456376ac53fde7cace1ef359d6a6f7a64c5b575ad77ea6e55ccc4  ./home-assistant/custom_components/gree_controller/api.py
@@ -18,7 +18,7 @@ b7f0873109c52be9d7f09bea3dffc416103c50085e1f0680d11661a969479898  ./home-assista
 5a96fe8f5c035c34f1339370270cd078056202d09e236dec75735be11de92a7d  ./home-assistant/custom_components/gree_controller/entity_map.py
 c4fb75c246db651087900ebfc2291ff41ac87652cd6194fc0b776b0005c1cbcf  ./home-assistant/custom_components/gree_controller/icon.png
 c4fb75c246db651087900ebfc2291ff41ac87652cd6194fc0b776b0005c1cbcf  ./home-assistant/custom_components/gree_controller/logo.png
-9b31873cdc44b589a4230346e6cd9ee25325b431ccf06b39f07393793410bf65  ./home-assistant/custom_components/gree_controller/manifest.json
+500f87cbfac7c933a5c22f974bf15ec8ee25ed1136eac7eeafe6a2918f8cd503  ./home-assistant/custom_components/gree_controller/manifest.json
 c52a484b671ce738ecc00228a1db19a5d703f69ab27530c2896a5c2ae3b4a96f  ./home-assistant/custom_components/gree_controller/number.py
 39c4309001b75abb56234f05662bc06e077054986876f1927937edbce528ec95  ./home-assistant/custom_components/gree_controller/select.py
 cca65482e36d48035aca178121a378fe7d578d600acff267ae81a6399c0da653  ./home-assistant/custom_components/gree_controller/sensor.py
@@ -69,7 +69,7 @@ fdcd9a5055d08037278b842e7ab69265345c5811f0a06867136c511d140bb191  ./presets/wind
 804f22123cd3e8db0fac791826c8dd9f758fb866c8e3b5655fb6d25d259dccf1  ./presets/workday_comfort.json
 01952aa92b217f8eae2493b88870e2dec595100cd15c4d561ff11ae2b936c46f  ./regenerate-sha.sh
 c64b1c6deeb24f20af662bfce7fa3683703914987241107ce664fa2f6d1a9dcb  ./scripts/README.md
-615b8c7c1c085f3dba2ddc10184b2223b2106c94f7a69ccc0592bf05b2323f27  ./scripts/api_dev_test.py
+b48677a5d38684a524c6a1b0275bb6640fa1fb87e05ba29e92470f2d0aa89957  ./scripts/api_dev_test.py
 5bc736c7bc76ca80aaa406bb171d2aa91baf4c3aa8695dce0e09b888b6ab3146  ./scripts/common.sh
 6403786610ee6d2f628193c25aee0dd058d62e904aa1a31d5f62fdaae0e94b4f  ./scripts/configure-gree-network.sh
 1d6e14e26e49aa9d3527f30a23668bf8d9c48b67e6628ef686c3155c012155de  ./scripts/dev.sh
@@ -195,6 +195,6 @@ c8c82e88c3715b1bfabf155e36266a4c94f5e2fc03eb39dcdd9d08a1985a997c  ./web/js/route
 4aadfdf107593d32ab73514688f225bf559fd5ce6bbf9d9459a8098daf1fbe3d  ./web/js/settings.js
 3815fea7ae1694568c2f249bc8460e0563ced6bde89214f74f21b41fe8cad9a6  ./web/lang-init.js
 6b653e4fe2d4db4ffae6ff8f39b8ce57a10a990dc0000ee4aae51d949afadd52  ./web/manifest.webmanifest
-8ea4f5cf1ebdf3894e17457020bde6d5fae324eadcc0ff35a6ac4efe5d5b2b6a  ./web/styles.css
+82396746ec3d334d4909d65276d2074da897cf7f8d4e9b8c04ea0747fd4b7cd3  ./web/styles.css
 fefdf12cbbb0a5d8a2cb89275cae28455aa42aaf179542305cc8f5e0f4825898  ./web/sw.js
 d505d793ce7cc9485b45b78bba1c0d51887adc7451ab59a42702946e5b991382  ./web/theme-init.js
diff --git a/README.md b/README.md
index 661fd63..fd966cd 100644
--- a/README.md
+++ b/README.md
@@ -2,9 +2,9 @@
 
 Self-hosted controller for GREE-compatible air conditioners with a local Web UI, thermostat zones, schedules, Home Assistant integration, history, notifications and a documented HTTP/WebSocket API.
 
-**Current release: 0.13.8**
+**Current release: 0.13.9**
 
-Release 0.13.8 removes the visible English-to-selected-language flash during Web UI startup. A dedicated `lang-init.js` applies the preferred language before first paint, the application is revealed only after localization initialization, and content-versioned language packs can use the browser cache safely.
+Release 0.13.9 fixes dashboard thermostat card sizing when local thermostat or manual device control is active. Cards now keep their intrinsic height instead of stretching every thermostat in the same grid row; API contracts are unchanged.
 
 Release 0.13.6 adds a dedicated notification toggle for GREE vs Home Assistant room-temperature discrepancies. Disabling this alert suppresses `zone.sensor_discrepancy` notifications only; sensor fallback and thermostat safety behavior are unchanged.
 
diff --git a/docs/API.md b/docs/API.md
index 4f2705b..cf1103f 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -1,6 +1,6 @@
 # GREE Controller API reference
 
-HTTP and WebSocket API for GREE Controller **0.13.8**.
+HTTP and WebSocket API for GREE Controller **0.13.9**.
 
 [← Main documentation](../README.md)
 
@@ -232,7 +232,7 @@ Response:
 {
   "status": "ok",
   "name": "gree-controller",
-  "version": "0.13.8",
+  "version": "0.13.9",
   "uptime_seconds": 1234,
   "control_ready": true,
   "time": "2026-08-30T06:54:00Z"
@@ -295,7 +295,7 @@ Returns the initial Web UI snapshot:
   "control_plan": {"generated_at": "2026-09-04T08:00:00Z", "zones": [], "rules": []},
   "control_plan_revision": 42,
   "system": {
-    "version": "0.13.8",
+    "version": "0.13.9",
     "uptime_seconds": 1234,
     "auth_required": false,
     "control_ready": true,
diff --git a/docs/openapi.json b/docs/openapi.json
index 1ef06d6..de07034 100644
--- a/docs/openapi.json
+++ b/docs/openapi.json
@@ -2,9 +2,9 @@
   "openapi": "3.1.0",
   "info": {
     "title": "GREE Controller API",
-    "version": "0.13.8",
+    "version": "0.13.9",
     "summary": "Local HTTP/WebSocket API for GREE HVAC control",
-    "description": "Self-hosted API used by the GREE Controller Web UI and Home Assistant integration.\n\n### Authentication\nNormal administrator endpoints accept `Authorization: Bearer <APP_TOKEN>` or `x-api-token: <APP_TOKEN>` when `GREE_CONTROLLER_APP_TOKEN` is configured. If the app token is empty, those endpoints intentionally run in trusted-LAN mode without authentication.\n\nThe restricted `/api/integrations/home-assistant/*` control surface always requires either a generated access token or the administrator app token. Generated tokens do **not** grant normal administrator API access.\n\nIn Swagger UI use **Authorize** and enter the token in either the bearer field or `x-api-token` field.\n\n### Control ownership\nThermostat zones, groups, house rules, direct device control, schedules and visual Flows share an ownership/arbitration model. Prefer zone/group/house endpoints for thermostat intent; direct device commands are technical/manual control and can deliberately take ownership.\n\n### 0.12.0 breaking API\nRuntime settings are split into functional `/api/settings/*` resources. The former `/api/settings`, `/api/debug`, `/api/events/retention`, `/api/settings/export` and `/api/settings/import` endpoints were removed without compatibility aliases.\n\n### 0.13.0\n`control-plan` keeps its existing HTTP response shape but is materialized in memory and pushed to WebSocket clients as `control_plan.updated`; HTTP remains the fallback/resync path. A restricted Home Assistant snapshot endpoint combines devices, groups and the control plan.\n\n### 0.13.1\nRuntime WebSocket churn is reduced without changing contracts: no-op zone regulator heartbeats are deduplicated and device heartbeat polls only invalidate the materialized control plan when plan-relevant device state changes.\n\n### 0.13.2\nCompletes live WebSocket synchronization for entity creation, schedules, automations, configuration imports and runtime device/automation state while preserving the existing HTTP API contracts and control-plan fallback behavior.\n\n### 0.13.3\nLogical thermostat targets are normalized to 0.1 C consistently, including Temporary Quick Thermostat and thermostat-managed automation/Flow actions. The bundled Web UI accepts comma or dot decimal input for the temporary thermostat target; physical GREE setpoint rounding is unchanged.\n\n### 0.13.4\nDisabled-zone thermostat controls remain visually active in the bundled Web UI because explicit temporary/manual thermostat and direct manual control remain available while zone automation is disabled. HTTP and WebSocket contracts are unchanged.\n\n### 0.13.5\nThe zone settings dialog now explains directly beside the enabled/disabled option that disabling a zone stops automation but does not block manual thermostat, temporary thermostat or direct manual control. HTTP and WebSocket contracts remain unchanged.\n\n### 0.13.6\nNotification settings add a dedicated sensor_discrepancy alert type for GREE vs Home Assistant room-temperature divergence. Disabling it suppresses only that notification; the GREE safety fallback remains active.\n\n### 0.13.7\nThe bootstrap snapshot now embeds all eight redacted runtime settings views. The bundled Web UI consumes those settings directly for HTTP startup and WebSocket resynchronization, removing the previous settings-request fan-out while preserving the split settings endpoints for direct reads and writes.\n\n### 0.13.8\nThe bundled Web UI suppresses the initial English-to-selected-language flash with a dedicated pre-paint language initializer and reveals the application only after localization is initialized. Language-pack URLs are content-versioned so immutable browser caching stays safe across updates.",
+    "description": "Self-hosted API used by the GREE Controller Web UI and Home Assistant integration.\n\n### Authentication\nNormal administrator endpoints accept `Authorization: Bearer <APP_TOKEN>` or `x-api-token: <APP_TOKEN>` when `GREE_CONTROLLER_APP_TOKEN` is configured. If the app token is empty, those endpoints intentionally run in trusted-LAN mode without authentication.\n\nThe restricted `/api/integrations/home-assistant/*` control surface always requires either a generated access token or the administrator app token. Generated tokens do **not** grant normal administrator API access.\n\nIn Swagger UI use **Authorize** and enter the token in either the bearer field or `x-api-token` field.\n\n### Control ownership\nThermostat zones, groups, house rules, direct device control, schedules and visual Flows share an ownership/arbitration model. Prefer zone/group/house endpoints for thermostat intent; direct device commands are technical/manual control and can deliberately take ownership.\n\n### 0.12.0 breaking API\nRuntime settings are split into functional `/api/settings/*` resources. The former `/api/settings`, `/api/debug`, `/api/events/retention`, `/api/settings/export` and `/api/settings/import` endpoints were removed without compatibility aliases.\n\n### 0.13.0\n`control-plan` keeps its existing HTTP response shape but is materialized in memory and pushed to WebSocket clients as `control_plan.updated`; HTTP remains the fallback/resync path. A restricted Home Assistant snapshot endpoint combines devices, groups and the control plan.\n\n### 0.13.1\nRuntime WebSocket churn is reduced without changing contracts: no-op zone regulator heartbeats are deduplicated and device heartbeat polls only invalidate the materialized control plan when plan-relevant device state changes.\n\n### 0.13.2\nCompletes live WebSocket synchronization for entity creation, schedules, automations, configuration imports and runtime device/automation state while preserving the existing HTTP API contracts and control-plan fallback behavior.\n\n### 0.13.3\nLogical thermostat targets are normalized to 0.1 C consistently, including Temporary Quick Thermostat and thermostat-managed automation/Flow actions. The bundled Web UI accepts comma or dot decimal input for the temporary thermostat target; physical GREE setpoint rounding is unchanged.\n\n### 0.13.4\nDisabled-zone thermostat controls remain visually active in the bundled Web UI because explicit temporary/manual thermostat and direct manual control remain available while zone automation is disabled. HTTP and WebSocket contracts are unchanged.\n\n### 0.13.5\nThe zone settings dialog now explains directly beside the enabled/disabled option that disabling a zone stops automation but does not block manual thermostat, temporary thermostat or direct manual control. HTTP and WebSocket contracts remain unchanged.\n\n### 0.13.6\nNotification settings add a dedicated sensor_discrepancy alert type for GREE vs Home Assistant room-temperature divergence. Disabling it suppresses only that notification; the GREE safety fallback remains active.\n\n### 0.13.7\nThe bootstrap snapshot now embeds all eight redacted runtime settings views. The bundled Web UI consumes those settings directly for HTTP startup and WebSocket resynchronization, removing the previous settings-request fan-out while preserving the split settings endpoints for direct reads and writes.\n\n### 0.13.8\nThe bundled Web UI suppresses the initial English-to-selected-language flash with a dedicated pre-paint language initializer and reveals the application only after localization is initialized. Language-pack URLs are content-versioned so immutable browser caching stays safe across updates.\n\n### 0.13.9\nThe bundled Web UI keeps dashboard thermostat cards at their intrinsic height when a local thermostat or manual device-control takeover panel is shown, preventing unrelated thermostat cards in the same grid row from stretching. HTTP and WebSocket contracts are unchanged.",
     "license": {
       "name": "MIT"
     }
@@ -4891,7 +4891,7 @@
           },
           "version": {
             "type": "string",
-            "example": "0.13.8"
+            "example": "0.13.9"
           },
           "uptime_seconds": {
             "type": "integer",
diff --git a/home-assistant/custom_components/gree_controller/manifest.json b/home-assistant/custom_components/gree_controller/manifest.json
index e79707f..b3d5afd 100644
--- a/home-assistant/custom_components/gree_controller/manifest.json
+++ b/home-assistant/custom_components/gree_controller/manifest.json
@@ -1,7 +1,7 @@
 {
   "domain": "gree_controller",
   "name": "GREE Controller",
-  "version": "0.13.8",
+  "version": "0.13.9",
   "config_flow": true,
   "integration_type": "hub",
   "iot_class": "local_polling",
diff --git a/scripts/api_dev_test.py b/scripts/api_dev_test.py
index c36eb80..21b7010 100644
--- a/scripts/api_dev_test.py
+++ b/scripts/api_dev_test.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Developer smoke/integration tests for GREE Controller API 0.13.8.
+"""Developer smoke/integration tests for GREE Controller API 0.13.9.
 
 Default mode is read-only and safe to run against a real controller.
 Use --settings-write to additionally round-trip all split settings resources and
@@ -26,7 +26,7 @@ from typing import Any, Callable, Iterable, Optional
 
 DEFAULT_BASE_URL = os.environ.get("GREE_API_URL", "http://127.0.0.1:8787")
 DEFAULT_TOKEN = os.environ.get("GREE_API_TOKEN", "")
-DEFAULT_EXPECTED_VERSION = "0.13.8"
+DEFAULT_EXPECTED_VERSION = "0.13.9"
 
 SETTINGS_PATHS: dict[str, set[str]] = {
     "/api/settings/application": {"simulator_enabled"},
@@ -553,7 +553,7 @@ def run_suite(args: argparse.Namespace) -> int:
     print(f"Settings write tests: {'ENABLED' if args.settings_write else 'disabled'}\n")
 
     runner.run("public health", lambda: test_health(client, args.expected_version))
-    runner.run("OpenAPI 0.13.8 contract", lambda: test_openapi(client, args.expected_version))
+    runner.run("OpenAPI 0.13.9 contract", lambda: test_openapi(client, args.expected_version))
     runner.run("bootstrap snapshot contract", lambda: test_bootstrap_contract(client))
     runner.run("protected API requires auth", lambda: test_protected_auth(client))
 
@@ -622,7 +622,7 @@ def run_suite(args: argparse.Namespace) -> int:
 
 def parse_args(argv: Optional[Iterable[str]] = None) -> argparse.Namespace:
     parser = argparse.ArgumentParser(
-        description="Developer smoke/integration tests for GREE Controller API 0.13.8.",
+        description="Developer smoke/integration tests for GREE Controller API 0.13.9.",
         formatter_class=argparse.RawDescriptionHelpFormatter,
         epilog="""Examples:
   python3 scripts/api_dev_test.py
diff --git a/web/styles.css b/web/styles.css
index b9cd152..3dd815d 100644
--- a/web/styles.css
+++ b/web/styles.css
@@ -4360,6 +4360,17 @@ body.simulation-standalone [data-view="simulation"] {
   height: 100%;
 }
 
+/* Dashboard thermostat cards keep their intrinsic height when one zone shows
+   a local/manual takeover panel. Other grids retain equal-height rows. */
+#dashboardZones {
+  grid-auto-rows: auto;
+  align-items: start;
+}
+
+#dashboardZones>article {
+  height: auto;
+}
+
 #deviceList .device-card .card-menu {
   flex-wrap: wrap;
   justify-content: flex-end;